Overview
Access details - By type is a document type in Azure Documenter that reports the access granted within Azure Active Directory, organized by identity type — groups, service principals, and users. For each identity, it shows detailed identity information and their role assignments across subscriptions and resource groups.
Business value
Access details - By type gives administrators and security teams a clear breakdown of which specific identities hold access across their Azure environment, organized by identity category — making it easier to audit service principal, group, or user access during compliance reviews or security assessments.
Prerequisites
To generate this document, the app registration must have the following Application permissions configured in Microsoft Entra ID:
User.Read.All— required to read user profiles and their role assignmentsGroup.Read.All— required to read Azure Active Directory group memberships and their role assignments
These must be granted as Application permissions (not delegated), and a tenant administrator must grant tenant-wide admin consent before they take effect. For the complete list of permissions required across all document types, see Managing service principals in Azure Documenter.
Required permissions
| Role | Permission level | Access |
|---|---|---|
| Account owner, Owner, Contributor | — | Full access to the Documentation section |
| Custom role | Read | View documents generated under Documentation |
| Custom role | Manage | View, generate, and manage documents under Documentation |
How it works
The Access details - By type document organizes identity and role information by identity type. The document includes a summary section stating the generation timestamp and the identity types and identities included in the report.
For each identity type selected in the configuration, the document produces one section per identity:
Service principals — for each service principal, the document shows technical identity details followed by subscription access data:
| Field | Description |
|---|---|
| Object ID | The service principal's Azure AD object identifier |
| Display Name | The display name of the service principal |
| Application (Client) ID | The application (client) ID associated with the service principal |
| Managed Identity | Whether the service principal is a managed identity |
Groups — for each AD group, the document shows group details followed by subscription access data.
Users — for each user, the document shows user details followed by subscription access data.
Following the identity details, each identity section lists per-subscription access in a table:
| Column | Description |
|---|---|
| Resource group | The resource group within the subscription |
| Role | The Azure role assigned to the identity in that resource group |
Steps
Use the following steps to generate an Access details - By type document. Navigate to Azure Documenter to get started.
- Click New configuration. The Configure your document wizard opens.
- In Step 1 — Basics, enter a configuration name. Under Choose document type, select Access details - By type. Configure the following options:
- Include — select the identity types to include in the report: Groups, Service principals, and/or Users
- Scope — filters the report to a specific scope: All, Subscription, Resource group, or Resource
- Role — filters the report to a specific role type: All, Built-in role, or Custom role
- In Step 2 — Service principal, select the service principal and configure the subscription scope. Click Next.
- Complete Steps 3–6 (Branding, Publish settings, Schedule, Notifications) as required. Click Next after each step.
- In Step 7 — Review, confirm your configuration and click Finish.
Once generation is complete, a URL is created for the document, and you can download it using the Download link.
Example scenario
A security team preparing for a compliance audit needs to review all service principal access across their Azure subscriptions. They generate an Access details - By type document with Service principals selected under Include, producing a focused report listing every service principal's identity details and its resource group role assignments across all subscriptions.
Troubleshooting
-
Access details document returns no data
Cause: no identities of the selected type have role assignments in the selected subscriptions, or the service principal lacks the required Microsoft Graph API permissions.
Fix: verify the service principal hasUser.Read.AllandGroup.Read.AllApplication permissions with tenant-wide admin consent, and that role assignments exist for the selected identity types. -
Document generation fails or returns incomplete data
Cause: the service principal is missing theUser.Read.AllorGroup.Read.AllApplication permission, or tenant-wide admin consent has not been granted.
Fix: grant both permissions to the app registration in Microsoft Entra ID and ensure a tenant administrator provides admin consent. See Managing service principals in Azure Documenter for the full permissions reference. -
Include filter returns fewer identities than expected
Cause: the Include filter is limiting the output to a subset of identity types.
Fix: enable all three identity types (Groups, Service principals, Users) in the Include setting and regenerate.
FAQs
-
How does Access details - By type differ from Access details - By subscription?
Access details - By type organizes the report by identity type, showing each identity's details and its access across subscriptions. Access details - By subscription organizes by subscription first, listing all identities with access within each subscription. Use By type when auditing a specific identity category; use By subscription for a per-subscription access review. -
Why does the service principal need Microsoft Graph API permissions?
The document reads Active Directory group, user, and service principal role assignments, which requires theUser.Read.AllandGroup.Read.AllApplication permissions on the app registration. -
Can I filter by role type in this document?
Yes. Use the Role filter to limit the output to All, Built-in role, or Custom role assignments.